semantic-release 21.0.1 → 21.0.3-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -41,6 +41,7 @@ This removes the immediate connection between human emotions and version numbers
|
|
|
41
41
|
- Avoid potential errors associated with manual releases
|
|
42
42
|
- Support any [package managers and languages](docs/recipes/release-workflow/README.md#package-managers-and-languages) via [plugins](docs/usage/plugins.md)
|
|
43
43
|
- Simple and reusable configuration via [shareable configurations](docs/usage/shareable-configurations.md)
|
|
44
|
+
- Support for [npm package provenance](https://github.com/semantic-release/npm#npm-provenance) that promotes increased supply-chain security via signed attestations on GitHub Actions
|
|
44
45
|
|
|
45
46
|
## How does it work?
|
|
46
47
|
|
|
@@ -142,7 +142,7 @@ Information related to the last release found:
|
|
|
142
142
|
| gitTag | `String` | The [Git tag](https://git-scm.com/book/en/v2/Git-Basics-Tagging) associated with the last release. |
|
|
143
143
|
| channel | `String` | The distribution channel on which the last release was initially made available (`undefined` for the default distribution channel). |
|
|
144
144
|
|
|
145
|
-
**
|
|
145
|
+
**Note**: If no previous release is found, `lastRelease` will be an empty `Object`.
|
|
146
146
|
|
|
147
147
|
Example:
|
|
148
148
|
|
|
@@ -174,3 +174,11 @@
|
|
|
174
174
|
- [semantic-release-coralogix](https://github.com/adobe/semantic-release-coralogix)
|
|
175
175
|
- `verifyConditions` Verified that required credentials are provided and API is accessible
|
|
176
176
|
- `publish` add a release tag to Coralogix
|
|
177
|
+
- [semantic-release-major-tag](https://github.com/doteric/semantic-release-major-tag)
|
|
178
|
+
- `success` Create major version tag, for example `v1`.
|
|
179
|
+
- [semantic-release-yarn](https://github.com/hongaar/semantic-release-yarn)
|
|
180
|
+
- **Note**: this is an alternative to the default `@semantic-release/npm` plugin and adds support for monorepos.
|
|
181
|
+
- `verifyConditions` Verify Yarn 2 or higher is installed, verify the presence of a NPM auth token (either in an environment variable or a `.yarnrc.yml` file) and verify the authentication method is valid.
|
|
182
|
+
- `prepare` Update the `package.json` version and create the package tarball.
|
|
183
|
+
- `addChannel` Add a tag for the release.
|
|
184
|
+
- `publish` Publish to the npm registry.
|
|
@@ -6,6 +6,11 @@ The [Authentication](../../usage/ci-configuration.md#authentication) environment
|
|
|
6
6
|
|
|
7
7
|
In this example a publish type [`NPM_TOKEN`](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) is required to publish a package to the npm registry. GitHub Actions [automatically populate](https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret) a [`GITHUB_TOKEN`](https://help.github.com/en/articles/creating-a-personal-access-token-for-the-command-line) environment variable which can be used in Workflows.
|
|
8
8
|
|
|
9
|
+
## npm provenance
|
|
10
|
+
|
|
11
|
+
Since GitHub Actions is a [supported provider](https://docs.npmjs.com/generating-provenance-statements#provenance-limitations) for [npm provenance](https://docs.npmjs.com/generating-provenance-statements), it is recommended to enable this to increase supply-chain security for your npm packages.
|
|
12
|
+
Find more detail about configuring npm to publish with provenance through semantic-release [in the documentation for our npm plugin](https://github.com/semantic-release/npm#npm-provenance).
|
|
13
|
+
|
|
9
14
|
## Node project configuration
|
|
10
15
|
|
|
11
16
|
[GitHub Actions](https://github.com/features/actions) support [Workflows](https://help.github.com/en/articles/configuring-workflows), allowing to run tests on multiple Node versions and publish a release only when all test pass.
|
|
@@ -23,10 +28,19 @@ on:
|
|
|
23
28
|
push:
|
|
24
29
|
branches:
|
|
25
30
|
- master
|
|
31
|
+
|
|
32
|
+
permissions:
|
|
33
|
+
contents: read # for checkout
|
|
34
|
+
|
|
26
35
|
jobs:
|
|
27
36
|
release:
|
|
28
37
|
name: Release
|
|
29
38
|
runs-on: ubuntu-latest
|
|
39
|
+
permissions:
|
|
40
|
+
contents: write # to be able to publish a GitHub release
|
|
41
|
+
issues: write # to be able to comment on released issues
|
|
42
|
+
pull-requests: write # to be able to comment on released pull requests
|
|
43
|
+
id-token: write # to enable use of OIDC for npm provenance
|
|
30
44
|
steps:
|
|
31
45
|
- name: Checkout
|
|
32
46
|
uses: actions/checkout@v3
|
|
@@ -37,7 +51,9 @@ jobs:
|
|
|
37
51
|
with:
|
|
38
52
|
node-version: "lts/*"
|
|
39
53
|
- name: Install dependencies
|
|
40
|
-
run: npm
|
|
54
|
+
run: npm clean-install
|
|
55
|
+
- name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
|
|
56
|
+
run: npm audit signatures
|
|
41
57
|
- name: Release
|
|
42
58
|
env:
|
|
43
59
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
@@ -24,9 +24,28 @@ For other type of projects we recommend installing **semantic-release** directly
|
|
|
24
24
|
$ npx semantic-release
|
|
25
25
|
```
|
|
26
26
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
27
|
+
### Notes
|
|
28
|
+
|
|
29
|
+
1. If you've globally installed **semantic-release** then we recommend that you set the major **semantic-release** version to install.
|
|
30
|
+
For example, by using `npx semantic-release@18`.
|
|
31
|
+
This way you control which major version of **semantic-release** is used by your build, and thus avoid breaking the build when there's a new major version of **semantic-release**.
|
|
32
|
+
This also means you, or a bot, must upgrade **semantic-release** when a new major version is released.
|
|
33
|
+
2. Pinning **semantic-release** to an exact version makes your releases even more deterministic.
|
|
34
|
+
But pinning also means you, or a bot, must update to newer versions of **semantic-release** more often.
|
|
35
|
+
3. You can use [Renovate's regex manager](https://docs.renovatebot.com/modules/manager/regex/) to get automatic updates for **semantic-release** in either of the above scenarios.
|
|
36
|
+
Put this in your Renovate configuration file:
|
|
37
|
+
```json
|
|
38
|
+
{
|
|
39
|
+
"regexManagers": [
|
|
40
|
+
{
|
|
41
|
+
"description": "Update semantic-release version used by npx",
|
|
42
|
+
"fileMatch": ["^\\.github/workflows/[^/]+\\.ya?ml$"],
|
|
43
|
+
"matchStrings": ["\\srun: npx semantic-release@(?<currentValue>.*?)\\s"],
|
|
44
|
+
"datasourceTemplate": "npm",
|
|
45
|
+
"depNameTemplate": "semantic-release"
|
|
46
|
+
}
|
|
47
|
+
]
|
|
48
|
+
}
|
|
49
|
+
```
|
|
50
|
+
4. `npx` is a tool bundled with `npm@>=5.2.0`. You can use it to install (and run) the **semantic-release** binary.
|
|
51
|
+
See [What is npx](../support/FAQ.md#what-is-npx) for more details.
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "semantic-release",
|
|
3
3
|
"description": "Automated semver compliant package publishing",
|
|
4
|
-
"version": "21.0.1",
|
|
4
|
+
"version": "21.0.3-beta.1",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"author": "Stephan Bönnemann <stephan@boennemann.me> (http://boennemann.me)",
|
|
7
7
|
"ava": {
|
|
@@ -28,9 +28,9 @@
|
|
|
28
28
|
"dependencies": {
|
|
29
29
|
"@semantic-release/commit-analyzer": "^9.0.2",
|
|
30
30
|
"@semantic-release/error": "^3.0.0",
|
|
31
|
-
"@semantic-release/github": "
|
|
31
|
+
"@semantic-release/github": "9.0.0-beta.2",
|
|
32
32
|
"@semantic-release/npm": "^10.0.2",
|
|
33
|
-
"@semantic-release/release-notes-generator": "^
|
|
33
|
+
"@semantic-release/release-notes-generator": "^11.0.0",
|
|
34
34
|
"aggregate-error": "^4.0.1",
|
|
35
35
|
"cosmiconfig": "^8.0.0",
|
|
36
36
|
"debug": "^4.0.0",
|
|
@@ -57,23 +57,22 @@
|
|
|
57
57
|
},
|
|
58
58
|
"devDependencies": {
|
|
59
59
|
"ava": "5.2.0",
|
|
60
|
-
"c8": "7.
|
|
60
|
+
"c8": "7.14.0",
|
|
61
61
|
"clear-module": "4.1.2",
|
|
62
62
|
"codecov": "3.8.3",
|
|
63
|
-
"delay": "5.0.0",
|
|
64
63
|
"dockerode": "3.3.5",
|
|
65
64
|
"file-url": "4.0.0",
|
|
66
65
|
"fs-extra": "11.1.1",
|
|
67
66
|
"got": "12.6.0",
|
|
68
67
|
"js-yaml": "4.1.0",
|
|
69
68
|
"mockserver-client": "5.15.0",
|
|
70
|
-
"nock": "13.3.
|
|
69
|
+
"nock": "13.3.1",
|
|
71
70
|
"p-retry": "5.1.2",
|
|
72
|
-
"prettier": "2.8.
|
|
73
|
-
"sinon": "15.0
|
|
71
|
+
"prettier": "2.8.8",
|
|
72
|
+
"sinon": "15.1.0",
|
|
74
73
|
"stream-buffers": "3.0.2",
|
|
75
74
|
"tempy": "3.0.0",
|
|
76
|
-
"testdouble": "3.
|
|
75
|
+
"testdouble": "3.18.0"
|
|
77
76
|
},
|
|
78
77
|
"engines": {
|
|
79
78
|
"node": ">=18"
|